feat: EasyRSA subprocess wrappers (revoke, build, gen-crl, copy-crl)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

tests/test_easyrsa.py

@@ -0,0 +1,67 @@
+import pytest
+from unittest.mock import patch, MagicMock
+from openvpncertupdate import (
+    revoke_issued, build_client_full, gen_crl, copy_crl, EasyRSAError,
+)
+
+
+def ok_result():
+    r = MagicMock(); r.returncode = 0; r.stderr = ""; return r
+
+def err_result():
+    r = MagicMock(); r.returncode = 1; r.stderr = "oops"; return r
+
+
+@patch("openvpncertupdate.subprocess.run")
+def test_revoke_includes_required_args(mock_run):
+    mock_run.return_value = ok_result()
+    revoke_issued("/er", "/pki", "alice", "capass")
+    args = mock_run.call_args[0][0]
+    assert args[0] == "/er/easyrsa"
+    assert "--batch" in args
+    assert "--pki=/pki" in args
+    assert "--passin=pass:capass" in args
+    assert "revoke-issued" in args
+    assert "alice" in args
+
+
+@patch("openvpncertupdate.subprocess.run")
+def test_revoke_omits_passin_when_empty(mock_run):
+    mock_run.return_value = ok_result()
+    revoke_issued("/er", "/pki", "alice", "")
+    args = mock_run.call_args[0][0]
+    assert not any(a.startswith("--passin") for a in args)
+
+
+@patch("openvpncertupdate.subprocess.run")
+def test_revoke_raises_on_failure(mock_run):
+    mock_run.return_value = err_result()
+    with pytest.raises(EasyRSAError, match="revoke-issued"):
+        revoke_issued("/er", "/pki", "alice", "")
+
+
+@patch("openvpncertupdate.subprocess.run")
+def test_build_client_full_args(mock_run):
+    mock_run.return_value = ok_result()
+    build_client_full("/er", "/pki", "bob", "keypass", "capass")
+    args = mock_run.call_args[0][0]
+    assert "--passout=pass:keypass" in args
+    assert "--passin=pass:capass" in args
+    assert "build-client-full" in args
+    assert "bob" in args
+
+
+@patch("openvpncertupdate.subprocess.run")
+def test_gen_crl_args(mock_run):
+    mock_run.return_value = ok_result()
+    gen_crl("/er", "/pki", "capass")
+    args = mock_run.call_args[0][0]
+    assert "gen-crl" in args
+
+
+@patch("openvpncertupdate.shutil.copy2")
+@patch("openvpncertupdate.os.chmod")
+def test_copy_crl_copies_and_chmods(mock_chmod, mock_copy):
+    copy_crl("/pki", "/etc/openvpn/crl.pem")
+    mock_copy.assert_called_once_with("/pki/crl.pem", "/etc/openvpn/crl.pem")
+    mock_chmod.assert_called_once_with("/etc/openvpn/crl.pem", 0o644)